[MelbourneDeveloper]

TLDR

Make a stable (non-prerelease) release publish end to end: NuGet over OIDC trusted publishing, and Homebrew/Scoop to the repositories that actually exist.

What Was Added?

• nuget-oidc-preflight job in release.yml. It exchanges a GitHub OIDC token with nuget.org (NuGet/login, pinned to v1.2.0) before any job publishes. publish-nuget, release-binaries and release-dotnet-binaries all wait for it, so a missing or mismatched trusted-publishing policy stops the release before anything ships. It also runs in the manual preflight.
• DataProviderMigrate --version / -V: prints the stamped release version (for example 0.11.0) without build metadata. The Homebrew formula test runs it.
• DataProviderMigrateVersionTests (in-process) and NativeAotMigrateSmokeTests.NativeBinary_Version_PrintsReleaseVersion (native binary).

What Was Changed or Deleted?

Every release so far was a beta, so the stable-only Homebrew/Scoop jobs had never run. A stable v0.11.0 tag would have hit these problems:

• Tap and bucket repos: the jobs targeted Nimblesite/homebrew-lql and Nimblesite/scoop-lql, which don't exist. They now target Nimblesite/homebrew-tap and Nimblesite/scoop-bucket, where the other Nimblesite tools publish.
• Secrets: the jobs read HOMEBREW_TAP_TOKEN and SCOOP_BUCKET_TOKEN, which aren't set anywhere. They now use the org secret BREW_SCOOP_PAT, which the other Nimblesite repos use. GitHub has no OIDC path for pushing to another repository.
• Broken Homebrew install of DataProviderMigrate: the formula did bin.install "DataProviderMigrate", leaving libe_sqlite3.dylib behind. On its own, the native binary crashes in SqliteConnection..ctor. The formula now installs the whole archive into libexec and puts an exec script in bin (bin.write_exec_script).
• Push race: lql-lsp and DataProviderMigrate push to the same tap and bucket from parallel jobs. Each push now rebases and retries up to 5 times, with a full-history checkout.
• NuGet over OIDC: publish-nuget now uses OIDC trusted publishing (user: Nimblesite, environment release) with a short-lived key minted right before the push. It no longer reads the NUGET_API_KEY secret.

How Do The Automated Tests Prove It Works?

• DataProviderMigrateVersionTests.Main_VersionFlag_PrintsReleaseVersion (--version, -V): exit 0, prints major.minor.patch[-pre], which is a prefix of the assembly's informational version.
• make aot RID=linux-x64 passes. All 5 NativeAotMigrateSmokeTests pass against the published native binary, including NativeBinary_Version_PrintsReleaseVersion. A build with -p:Version=0.11.0 prints 0.11.0.
• I ran the formula's layout locally: publish output in libexec, an exec script in another directory, run from a third working directory. migrate --provider sqlite passed, including the integrity check. The binary copied on its own (the old formula's layout) crashes loading SQLite.
• I rendered the formula from the workflow step for dataprovider-migrate, and ruby -c reports Syntax OK.
• make ci passes.

Spec / Doc Changes

• docs/specs/ci-spec.md: new [CI-RELEASE-NUGET-OIDC] and [CI-RELEASE-BREW-SCOOP] sections. [CI-RELEASE-PREFLIGHT] now lists NuGet trusted publishing.
• docs/specs/migration-spec.md [MIG-CLI-COMMANDS]: documents --version.

Breaking Changes

• None
• NuGet publishing requires a nuget.org trusted-publishing policy owned by Nimblesite for repository Nimblesite/DataProvider, workflow release.yml, environment release. Without it, the release stops at nuget-oidc-preflight before publishing anything.